Configuring Order Callbacks

In order for Weedmaps Orders to transmit order events to your system, you must configure callback (webhook) URLs. Without proper configuration, your integration will not receive order notifications.

As an integration partner, you are responsible for providing URL patterns that Weedmaps should use to deliver order events.

To get started with Order Callback Webhooks, please reach out to [email protected] for setup.

🚧

All Order Integration onboarding & setup is facilitated directly by Weedmaps.

Example Callback URL

https://integrator-host.com/callbacks/weedmaps/orders?merchant_id={{merchantId}}

• integrator-host.com — your domain or API host.
• {{merchantId}} — placeholder dynamically replaced with the Weedmaps Menu ID (merchant/location identifier) at runtime.

You can configure:

• A single default callback URL for all events, or
• Individual callback URLs per event type (e.g., draft, create).

Next Steps

Troubleshooting Callback Issues

Not Receiving Callbacks?

• Confirm URL Registration: Double-check that your callback URLs were successfully submitted to Weedmaps.
• Correct API Version: Ensure you're registering endpoints for the correct API version (e.g., /oos/2025-07/).
• SSL Requirement: Weedmaps only sends callbacks over HTTPS—ensure your endpoint has a valid SSL certificate.
• Publicly Accessible: Your callback endpoint must be accessible from the public internet (no internal-only IPs or VPN-restricted hosts).

Receiving 429 or 5XX Errors?

• Rate Limits: Frequent 429 errors may indicate your endpoint is calling back into Weedmaps too aggressively—review your outbound API usage.
• Retry Logic: Weedmaps retries failed Create callbacks twice; review your logs to confirm if all attempts are failing.
• High Latency or Timeouts: Long response times may result in failures—ensure your webhook endpoint processes payloads quickly.

Authentication Failures (Signature Verification)

• Signature Header Missing or Invalid:

  • Confirm you are properly validating the Signature header using HMAC-SHA256 with your client secret.
  • Double-check you’re signing the raw JSON body (prior to parsing).

• Base64 Encoding: Ensure your HMAC digest is Base64 encoded before comparison.

Unexpected Payload Structure

• Version Drift: Double-check the API version your callback endpoint supports matches what Weedmaps is sending.
• Schema Validation: Validate payloads against the latest OpenAPI specification to catch unexpected fields or missing data early. The version will show 2025-01, but there were no changes from 2025-01 to 2025-07.